An attacker who can query a readable collection in Payload CMS and control the sort order can choose a protected field as the sort key, allowing them to infer limited values of that field even though the field is not normally readable. This results in an information disclosure vulnerability, classified as CWE‑200 for data exposure and CWE‑863 for improper authorization checks.

Payload CMS versions earlier than 3.88.0 and canary releases before 4.0.0‑canary.27 are affected. The vulnerability impacts any deployment where users have read access to a collection and can specify sorting parameters, regardless of whether they have access to the protected field itself.

The CVSS score of 6.9 indicates a moderate severity. No EPSS score is available, and the vulnerability is not listed in the CISA KEV catalog, suggesting that it is not currently widely exploited. The likely attack path requires an attacker to have read access to a collection and the ability to submit sort parameters, typically via the CMS API or UI. By issuing repeated sorted queries, the attacker can deduce partial information about protected field values.